documentation-generation
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill generates and suggests CI/CD workflows and scripts that execute standard shell commands including npm, pip, mvnw, and uvicorn. These are used for extracting API specifications and calculating documentation coverage.
- [EXTERNAL_DOWNLOADS]: The generated configurations fetch resources from well-known services, such as @redocly/cli and @mermaid-js/mermaid-cli from the npm registry, and utilize widely-used GitHub Actions for repository tasks.
- [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by reading project configuration files and source code to populate documentation templates. 1. Ingestion points: Project metadata files (pom.xml, package.json, pyproject.toml, pubspec.yaml) and source code in src, lib, app, and api directories. 2. Boundary markers: No delimiters or warnings are used to differentiate project data from generation instructions. 3. Capability inventory: The skill has Read, Write, Edit, and Bash permissions. 4. Sanitization: The skill does not sanitize or validate project data before interpolating it into documentation templates.
Audit Metadata